Enforce minimum exchange rates

[gakonst]

Also... when/if we add that exchange rate logic, we definitely need to fix this: https://github.com/interledger-rs/interledger-rs/blob/master/crates/interledger-stream/src/client.rs#L121

Right now intermediary connectors can steal ALL the money!

Originally posted by @kincaidoneil in #256 (comment)

[kincaidoneil]

FWIW, since we now have exchange rates within the store, this might be simple to fix. We'd somehow need the STREAM receiver to send a ConnectionAssetDetails frame when the connection is first created (since it's stateless, one approach would be to include it in response to any request with a ConnectionNewAddress frame). Then the client could lookup the rate from its asset to the destination asset, and determine a reasonable minimum destination amount.

Edit: it also looks like the JS implementation uses a similar approach, by using the ConnectionNewAddress frame to determine if it's a new connection and then responding with a ConnectionAssetDetails frame: https://github.com/interledgerjs/ilp-protocol-stream/blob/bb1e830e418057be094af4fad452b8f2e25cb5cf/src/connection.ts#L627

[kincaidoneil]

Also, when we implement this, we need to update the STREAM sender to limit the delivered amount based on the minimum amount they set in the Prepare (the delivered amount should be the min of what the receiver claims they got, and what we told them was the minimum they should accept).

https://github.com/interledger-rs/interledger-rs/blob/748591691bf787bee8aafd380ac3d5c5872d82e5/crates/interledger-stream/src/client.rs#L306-L307

After we support invoices (paying by destination amount, rather than source amount), the recipient could fulfill the packet, but lie and say they received 0, which would cause the sender to continue sending indefinitely, draining their account.

JavaScript STREAM is also vulnerable... but Java is not! Woot @sappenin 🎉 (although I think it would incorrectly report the delivered amount to the application)

[sappenin]

although I think it would incorrectly report the delivered amount to the application

@kincaidoneil can you clarify that one? Is there a bug in the Java logic?

[sappenin]

@kincaidoneil this has been assigned to you - I think it's worth fixing.